General
- Target Tsuyoki_na_Shougun_Hime_wa_Chinpo_ni_Och_Archive_win64_2528.zip
- Size 768.4MB
- Sample260817-m335aaydma
- SHA256 4a83ebde0f622b7d065fc221e54d332559bf08681995a96feb278b1947654bd3
Malware Config
Targets
-
- Target Tsuyoki_na_Shougun_Hime_wa_Chinpo_ni_Och_Archive_win64_2528.zip
- Size 768.4MB
- SHA256 4a83ebde0f622b7d065fc221e54d332559bf08681995a96feb278b1947654bd3
Score1/10 -
- Target Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
Score7/10-
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target data/.cO4
- Size 332B
- SHA256 d2bf5080369f6b07d264d35f51e4d367ffa9a35c20b1903a6897e7290f68687c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/0KinEDg4ck1E.3e
- Size 10.5MB
- SHA256 8184518ff4a569bc296c3a8982488f7c9b4febb8df0b83e3ccf29d78a60a3e8b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 10cf83960c53d3aad6cc3f30e1e68d03d449ef9007d9fd91df658c7c45022781
Score3/10 -
- Target data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 4e2b5116fd4210116400a8d8a94fa48f254779e4284edda204c2d8517efae88e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/cache/screens.rpyb
- Size 125KB
- SHA256 818ebcdb3f1ca32c5c84a8c20ffe9f354af2e9ad62742b9393ab05d024d14c00
Score3/10 -
- Target data/cache/shaders.txt
- Size 202B
- SHA256 30d906b466a752e0d80e02298fcfacd07ae3a7f2a0628e172d5339253c0648fb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/gui/bar/bottom.png
- Size 973B
- SHA256 56e50fe3570b36caf6cfa55c527cd6b158f33f636061230a184d939ad5316707
Score1/10 -
- Target data/gui/bar/left.png
- Size 1KB
- SHA256 ee098f7309753ec90c9e5316336317d5aadd178abc4db1aa6113dfb6f0aeb6a6
Score1/10 -
- Target data/gui/bar/right.png
- Size 1KB
- SHA256 205e237c1e2372df0eaeecaa1adec438d4978fa3fa2cfe4c03dc4436a09d93a1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/gui/bar/top.png
- Size 1KB
- SHA256 91a55f716f37d5467e35d5f24f3b7cc02d7a0b78312033929128d5c083b6ea37
Score1/10 -
- Target data/gui/bubble.png
- Size 7KB
- SHA256 f9ede5e674239410faa990e25c066c107ee35d9d1f61510e877c7b75d112fa27
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/gui/button/check_foreground.png
- Size 617B
- SHA256 bd16c70c51e29f020a6a9f14d7d5b16933555c8f6de0b9f2f87490015af785b7
Score1/10 -
- Target data/gui/button/check_selected_foreground.png
- Size 875B
- SHA256 7de035431624ef277624b73aca99f6525bf16b4545536940a8373ae5bc8d2863
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 0e47d29d133feb25af286358ab58f6ae5acab922dced1a0ecc63de3fa3db8216
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.